CVE-2026-114110 in Astral
Summary
by MITRE • 10/21/2026
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Astral uv prior to version 0.11.6 represents a critical path traversal flaw within the Python package management ecosystem. This issue specifically affects the uninstallation process of packages distributed as wheel archives, which are standard binary distribution formats for Python software. The root cause lies in how the tool parses and processes the RECORD file contained within these wheels. The RECORD file serves as an integrity manifest that lists all files installed by a package along with their cryptographic hashes, allowing tools to verify installation completeness and facilitate clean removal of packages when they are uninstalled.
During the uninstallation phase, Astral uv reads this RECORD file to determine which files need to be deleted from the system. The vulnerability arises because the tool fails to adequately validate or sanitize the file paths listed in the RECORD entries before attempting deletion operations. Specifically, if a malicious wheel archive contains relative path traversal sequences such as ../ within its RECORD manifest, the uninstallation routine will interpret these literally without checking whether they resolve to locations outside the intended installation prefix directory. This lack of boundary enforcement allows an attacker to manipulate the file system state beyond the scope of the package being removed.
The operational impact of this vulnerability is severe and potentially catastrophic for end users who rely on Astral uv for managing their Python environments. By crafting a malicious wheel with carefully constructed RECORD entries, an adversary can cause the tool to delete arbitrary files located anywhere on the host file system where the user has write permissions or sufficient privileges during execution. This could lead to the destruction of critical operating system files, corruption of other installed packages, loss of important data, or complete compromise of the development environment's integrity. The attack vector is particularly insidious because it exploits a trusted workflow; users typically assume that uninstalling a package will only affect its own installation directory and not pose risks to unrelated parts of their file system.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to restrict pathname resolution within expected boundaries. It also relates to CWE-732: Incorrect Permission Assignment for Critical Resource if the deletion leads to unauthorized modification or destruction of sensitive files. In terms of adversary tactics, this behavior mirrors techniques found in MITRE ATT&CK under T1485: Data Destruction, where an attacker aims to disrupt availability by erasing data on a target system. The exploitation requires social engineering elements such as convincing users to install and subsequently uninstall a compromised package from untrusted sources or malicious repositories.
Mitigation strategies must focus primarily on immediate software updates and rigorous supply chain security practices. Users of Astral uv should upgrade to version 0.11.6 or later, where the path traversal issue has been resolved through improved validation logic that ensures all file paths referenced in RECORD files are strictly confined within the designated installation prefix before any deletion operations are performed. Additionally, organizations and individual developers should implement strict verification protocols for Python packages sourced from third-party repositories. This includes verifying package signatures using tools like sigstore or checking hashes against trusted sources prior to installation. Security teams should also monitor their environments for unexpected file deletions that correlate with package management activities, as this may indicate an ongoing exploitation attempt of similar vulnerabilities in other software components.